From: Evan Hunt <each@isc.org>
Date: Tue, 25 Jun 2024 21:39:58 +0000 (-0700)
Subject: reduce the max-recursion-queries default to 32
X-Git-Tag: v9.21.0~7^2~2
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=7e3b425dc283df66df9c46002307ab676e10e4fd;p=thirdparty%2Fbind9.git

reduce the max-recursion-queries default to 32

the number of iterative queries that can be sent to resolve a
name now defaults to 32 rather than 100.
---

diff --git a/bin/named/config.c b/bin/named/config.c
index 3ad700a8873..9b34b896c18 100644
--- a/bin/named/config.c
+++ b/bin/named/config.c
@@ -170,7 +170,7 @@ options {\n\
 	max-clients-per-query 100;\n\
 	max-ncache-ttl 10800; /* 3 hours */\n\
 	max-recursion-depth 7;\n\
-	max-recursion-queries 100;\n\
+	max-recursion-queries 32;\n\
 	max-stale-ttl 86400; /* 1 day */\n\
 	message-compression yes;\n\
 	min-ncache-ttl 0; /* 0 hours */\n\
diff --git a/bin/tests/system/reclimit/ns3/named1.conf.in b/bin/tests/system/reclimit/ns3/named1.conf.in
index 7771d834a2e..295eae0864b 100644
--- a/bin/tests/system/reclimit/ns3/named1.conf.in
+++ b/bin/tests/system/reclimit/ns3/named1.conf.in
@@ -22,6 +22,7 @@ options {
 	listen-on-v6 { none; };
 	servfail-ttl 0;
 	qname-minimization disabled;
+	max-recursion-queries 50;
 	max-recursion-depth 12;
 	recursion yes;
 	dnssec-validation yes;
diff --git a/bin/tests/system/resolver/ns1/named.conf.in b/bin/tests/system/resolver/ns1/named.conf.in
index d212869fa3e..3352b760ba1 100644
--- a/bin/tests/system/resolver/ns1/named.conf.in
+++ b/bin/tests/system/resolver/ns1/named.conf.in
@@ -30,6 +30,7 @@ options {
 	max-zone-ttl unlimited;
 	resolver-query-timeout 5000; # 5 seconds
 	attach-cache "globalcache";
+	max-recursion-queries 50;
 };
 
 trust-anchors { };
diff --git a/doc/arm/reference.rst b/doc/arm/reference.rst
index a1b3e2e2a71..b1a54621290 100644
--- a/doc/arm/reference.rst
+++ b/doc/arm/reference.rst
@@ -4594,9 +4594,12 @@ Tuning
    :tags: server, query
    :short: Sets the maximum number of iterative queries while servicing a recursive query.
 
-   This sets the maximum number of iterative queries that may be sent while
-   servicing a recursive query. If more queries are sent, the recursive
-   query is terminated and returns SERVFAIL. The default is 100.
+   This sets the maximum number of iterative queries that may be sent
+   by a resolver while looking up a single name. If more queries than this
+   need to be sent before an answer is reached, then recursion is terminated
+   and a SERVFAIL response is returned to the client. (Note: if the answer
+   is a CNAME, then the subsequent lookup for the target of the CNAME is
+   counted separately.) The default is 32.
 
 .. namedconf:statement:: notify-delay
    :tags: transfer, zone
diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c
index 2e625e7e0f4..78e0634aabc 100644
--- a/lib/dns/resolver.c
+++ b/lib/dns/resolver.c
@@ -215,7 +215,7 @@
 
 /* The default maximum number of iterative queries to allow before giving up. */
 #ifndef DEFAULT_MAX_QUERIES
-#define DEFAULT_MAX_QUERIES 100
+#define DEFAULT_MAX_QUERIES 50
 #endif /* ifndef DEFAULT_MAX_QUERIES */
 
 /*